From the Next Word to the Next Entry Point

OpeningHave you ever imagined this?

Have you ever imagined saying to an AI assistant, “Buy me a cup of milk tea,” and having it actually open a delivery app, choose a shop, place the order, and pay for you?

Technically, that is already possible. But in reality, 155 apps have said “no” to one company trying to do exactly that.

Today, I want to start with this current event, then step back and explain the technology behind it: What is a large language model? What is a token? What is a harness — the layer that turns prediction into action? And finally, I will return to the event itself — the Doubao Mobile Assistant’s SAEP protocol being rejected by major platforms — and analyze why it happened.

Part OneWhat is a large language model?

1.1A one-sentence definition

A large language model, or LLM, is essentially a super-powered probability prediction engine.

Its core task sounds extremely simple: given all the words that came before, predict the most likely next word.

Repeat that task billions of times, and something surprising happens. The model does not just learn grammar. It begins to write, translate, summarize, answer questions, write code, and even reason. This is often called “emergence.”

1.2A simple analogy

Imagine a friend who has read millions of books — Wikipedia, news articles, research papers, novels, and computer code. This friend has a very good memory, but does not memorize everything word for word. Instead, he understands the patterns of language.

Ask him anything, and he can organize an answer. Sometimes he makes things up. That is called “hallucination.” But most of the time, he is surprisingly useful.

That friend is a large language model.

1.3The core technology: the Transformer

Why can LLMs understand long texts? The key breakthrough was the Transformer architecture, introduced by Google in 2017.

Before Transformers, AI read text almost like a person reading one word at a time — by the time it reached the end, it might have forgotten the beginning.

Transformers introduced something called “self-attention.” This allows the model to scan the whole text at once and automatically identify which words matter most.

For example, in the sentence “That bank refused to open an account because it had no money,” the attention mechanism can quickly understand that “it” refers to the bank, not the account.

1.4Three stages of training

Training an LLM usually happens in three stages.

First, pre-training. The model reads trillions of tokens of text and learns grammar, facts, and logic. This is the most expensive stage.

Second, instruction fine-tuning. The model is taught how to follow instructions and hold a conversation.

Third, reinforcement learning from human feedback. Humans rate the model’s answers, and the model adjusts its style to become safer, more helpful, and more natural.

Part TwoWhat is a token?

2.1Tokens are the building blocks of AI

Large models do not directly “see” words. They first break text into small pieces called tokens.

For example, the sentence “I love eating sweet ice cream” might be split into “I,” “love,” “eating,” “sweet,” “ice,” “cream,” and “.” Each piece is a token. Even punctuation marks count.

2.2Why tokens matter

Tokens matter because almost everything about AI is measured in tokens.

First, billing. When you call a large model API, the cost is usually calculated by tokens. For example, Alibaba Cloud’s flagship Qwen3.8-Max model charges 12 yuan per million input tokens and 36 yuan per million output tokens.

Second, context window. How much a model can “remember” is also measured in tokens. Some versions of ChatGPT support a 128k token context window.

Third, understanding. When an AI understands a word, it looks at how that word relates to others. For example, the word “watermelon” may appear with “eat” and “sweet,” but it can also appear with “phone” and “launch event.” When the AI sees “watermelon phone,” it adjusts the meaning of “watermelon” so that it is closer to “brand” and farther from “food.”

2.3A striking number

Today, major Chinese large models together consume around 180 trillion tokens per day.

That is a scale far beyond the total information contained in all the books in human history.

Part ThreeWhat is a harness?

Parts One and Two described the engine. This part is about the chassis.

By the end of 2026, a sentence you hear in almost every engineering meeting is: the model is no longer the product — the harness is. It sounds like hype. It is also, more or less, true. It explains why the same model can feel like a genius in one app and a liability in another, and why two companies using identical models can ship completely different products.

3.1The layer that actually does the work

A language model only predicts the next word. Ask it to buy you a white T-shirt and it will produce a very convincing description of someone buying a white T-shirt. Something else has to open the app, read the screen, tap the search box, compare prices, and pay.

That something is the harness.

A harness is everything around a model that turns its reasoning into action: the context it is allowed to see, the tools it can call, the loop that decides when to stop, the permissions it runs under, and the checks that decide whether the work actually counted. Databricks puts the whole equation in three words: Agent = Model + Harness.

Think of a brilliant new hire. Give her a desk, a laptop, a login, a phone, and a reviewer for her work, and she can do the job. Give her only the desk, and she will write you a very good essay about the job. Same brain. Different harness.

3.2What is inside one

Open up almost any agent product on the market today and you find the same five parts around the model.

Context. What the model can see at any moment: the conversation, the files, the screen, the search results, and the compressed memory of everything that happened earlier. Context is finite, so a real harness spends much of its effort deciding what to keep, what to summarise, and what to throw away.

Tools. The hands. A shell, a code editor, a browser, a calendar, a payments API. In 2026 many of these arrive through one shared standard — the Model Context Protocol, or MCP — which is what lets the same tool server serve several different agents.

The loop. The controller. Model output is a proposal, not an action; the harness executes it, feeds the result back, and decides whether to continue, ask a human, or stop. Almost every quality difference you feel in a product lives here.

Guardrails. The permissions, sandboxes, approval prompts, and audit logs. This is the least glamorous part and, as the next part will show, the one that decides whether an agent ships at all.

Evals. Tests, traces, and grading — the mechanism by which the harness knows whether the task actually succeeded, rather than whether the answer sounded right.

The vocabulary changes by vendor — Claude Code talks about skills, subagents, hooks, and plugins; other harnesses say workflows, checks, and policies — but the parts are the same. What differs is how well each part is built, and how honestly the company is willing to measure it.

3.3Same model, different result

If the harness matters that much, it should show up in the numbers. It does.

SWE-bench, the standard software-engineering benchmark, is named after its harness as much as its dataset. The evaluation harness builds a container for each task, applies the model’s patch, runs the repository’s own tests, and grades the result. Without that machinery, a “fix” is just a diff that looks plausible. With it, the score means something — and the harness itself becomes load-bearing.

1. 01ObserveRead the screen, the repo, the error message.
2. 02PlanChoose the next action, and the one after it.
3. 03ActCall a tool: click, edit, search, pay.
4. 04VerifyDid it work? If not, loop again.

A 2026 benchmark called Claw-SWE-Bench goes one step further and treats the harness as the variable being tested: the same prompt, the same runtime budget, the same workspace contract, the same patch-extraction step, and the same evaluator, so that harness A can be compared with harness B on equal footing. In other words, the industry has started grading the chassis, not only the engine.

This is why leaderboards increasingly report a pair rather than a model: (model, harness). Two entries can share the same underlying model and differ by ten points — because one of them compacts its context before it overflows, and the other does not.

Two things in that table are worth staring at. First, in this schematic almost all of the movement comes from the wrapper, not from the weights — the model never changes. Second, the cost is paid in tokens, and the bill arrives long before the benefit is obvious: the same loop that lets an agent retry is the loop that spends.

Birgitta Böckeler, writing on martinfowler.com in April 2026, gives the design work a name — harness engineering — and a useful test: harnessability, meaning how much of a task the harness can check by itself (tests, type checks, linters, schema validation) rather than by asking a human. The higher the harnessability, the less supervision the agent needs, and the more work it can be trusted with.

3.4The market map

The market has begun to sort itself by where the harness lives.

They compete on the same few things: how much context the harness can keep coherent, how safely it can be trusted with tools, how well it can verify its own work, and what a finished task actually costs. Inside that frame, the model is becoming a commodity. The harness is where the product is — and a new job title appeared alongside it: harness engineer.

3.5Why this is the real moat

Models are rented. Harnesses are owned.

Three things make a harness sticky. Permissions: every tool an agent is allowed to touch is a decision someone made once and does not want to make again. Memory and configuration: the files, conventions, integrations, tool servers, and checks that accumulate around a working setup. Data: every task leaves a trace — what the agent tried, where it failed, what a human corrected — and that trace is the best training material a company has.

There is a fourth, less comfortable reason: the interface. Whoever owns the harness owns the moment the user asks for something. The model behind it may be rented from a competitor, and most users will never know.

3.6Where harnesses fail

If the harness is where the work happens, it is also where the work goes wrong. Four failures recur across every product in the map above.

Prompt injection. To an agent, the screen, the web page, and the repository are all text — and text can contain instructions. A harness that cannot tell “content to read” from “orders to follow” will eventually be talked into something by a web page.

Over-permission. An agent with a shell, a browser, and a payment credential can do a week of damage in a minute. The usual answer is a sandbox: a contained environment where actions can be observed, replayed, and undone.

Silent loops. A harness that cannot verify its own work will happily burn a million tokens walking in a circle. Verification is not a nice-to-have; it is what stops the loop.

Confident completion. The most expensive failure is a task that reports success without having achieved anything — the agent equivalent of a hallucination, produced by the harness rather than the model.

Every one of these is, in the end, a question about permission and verification: what the agent may touch, and how anyone knows it worked. Which is exactly the question that the next part of this story turns into a headline.

Which brings us back to the story that opened this piece.

Part FourThe hot topic: Doubao Mobile Assistant’s SAEP — and the rejections

Seen through the lens of Part Three, the event reads differently. SAEP is not a model announcement. It is a harness protocol — an attempt to define how an assistant is allowed to operate a phone — and the 155 rejections are not a verdict on model quality. They are a verdict on permissions.

4.1What happened?

On October 14, 2026, Doubao Mobile Assistant announced that the 30-day public comment period for its Screen Automation Execution Protocol, or SAEP, had ended.

Under the protocol, Doubao Mobile Assistant would recognize on-screen elements and simulate human taps and typing across different apps to complete tasks for users.

For example, if you say, “Buy me a white T-shirt,” the AI could go to Taobao, search, compare, and place an order.

However, on the same day, a rejection list was published. WeChat, Taobao, Alipay, Meituan, Kuaishou, Pinduoduo, Xiaohongshu, DeepSeek, Kimi, multiple banks, and the three major telecom operators — 155 apps in total — explicitly refused.

• WeChat
• Taobao
• Alipay
• Meituan
• Kuaishou
• Pinduoduo
• Xiaohongshu
• DeepSeek
• Kimi
• Banks
• Telecom operators
• +144 more

4.2Why did they refuse? Three layers

Layer one: traffic sovereignty — they do not want to become backend execution nodes. In the past, when a user opened Taobao, the platform knew exactly what they viewed, what they clicked, and how long they stayed. This behavioral data supports advertising, recommendations, conversion, and the entire business loop.

But if an AI completes the purchase directly, the user may never even see Taobao’s homepage, its carefully arranged recommendations, or its ads. That value is then captured by the AI agent at the entry layer. In essence, super apps are trying to prevent themselves from degrading from “platform entry points” into “backend execution nodes.”

Layer two: security and responsibility — special concerns in sensitive scenarios. Banks and payment apps are mainly concerned about fund safety, identity verification, and responsibility attribution. Telecom operator apps involve phone numbers, real-name identity, balance, call records, and other sensitive information.

Screen automation means that a user’s ID number, service password, SMS verification code, and other key information may enter the AI’s “field of view.” This is especially sensitive because screen sharing and remote control are typical methods used in telecom and online fraud. A general-purpose agent that can “tap the phone for you” is naturally in tension with anti-fraud logic.

Layer three: peer competition — the battle for the AI entry point. DeepSeek, Kimi, and other AI apps also refused. The logic is straightforward: the AI agent entry point is the next bus that everyone is trying to catch. No one wants their own product to become an object that a competitor’s agent can operate.

4.3The deepest reason

Ultimately, this is a snapshot of a world where AI agents and traditional apps have not yet established rules.

Everyone wants to be the user’s first point of contact. No one wants to become just one execution step in someone else’s scheduling chain.

It is worth noting that ByteDance’s SAEP protocol is not entirely without value. Compared with overseas examples, Anthropic’s Computer Use and OpenAI’s Operator followed a “we do it first, you block it later” route. Doubao at least knocked on the door first, offering a negotiation framework of default openness, explicit refusal, and the ability to withdraw at any time.

ConclusionFrom technology back to people

Technically, what a large language model does is extremely simple: predict the next word.

But socially, when that ability becomes strong enough to understand a screen, simulate operations, and complete tasks on behalf of humans, it touches more than technical boundaries. It touches commercial interests, security bottom lines, and ecosystem rules.

The story of Doubao Mobile Assistant tells us one thing: the real challenge of AI may not be whether it can do something, but who will allow it to do so.

Part Three suggests a corollary. The companies that win the next two years may not be the ones with the best model. They will be the ones who own the harness — the context, the tools, the loop, the checks, and above all the permission to act. A model without a harness is an essay. A harness without permission is a demo.

Thank you.